Resubmissions
11/11/2023, 21:54
231111-1sgeesbg5t 811/11/2023, 21:52
231111-1rakgsbg3y 711/11/2023, 21:24
231111-z81mkabf5v 711/11/2023, 21:20
231111-z62f3scd27 711/11/2023, 21:19
231111-z6csqacd25 711/11/2023, 21:18
231111-z5pqwscc99 711/11/2023, 21:13
231111-z22laabf3w 911/11/2023, 21:10
231111-z1cwjacc82 711/11/2023, 20:08
231111-ywskracb37 7Analysis
-
max time kernel
77s -
max time network
1212s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
11/11/2023, 21:54
General
-
Target
888Rat.exe
-
Size
93.6MB
-
MD5
553951bbbde6c6001ade88f3a06a9b9a
-
SHA1
28cd84b4533433cc925123f106e4efbbddd3c2ca
-
SHA256
4870376811dd3c5eabe924c793079629d13a7813bf1a3014b5333b132be50365
-
SHA512
e9cf57ca2cd87fa2b3c05c0003ae11fc51d4139072d028ba52d665de57fffcb9c279cbe19ede001cc56ac464212ab8f6cbb8e7023c7ca567835a7b540a58521d
-
SSDEEP
1572864:ST0EdFgdUIGfkS0H4HHDXLYrXatfLllR3Rbop0+xXlMSyCXsRuG0CPb0V+8VM5km:ST0I1IGfr0H4HbLYrXajRPcl0issnM4s
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 51 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 46 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\888Rat.exe"C:\Users\Admin\AppData\Local\Temp\888Rat.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"3⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"4⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"5⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"6⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"7⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"8⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"9⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"10⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"11⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"12⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"13⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"14⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"15⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"16⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"17⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"18⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"19⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"21⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"23⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"24⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"25⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"26⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"27⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"28⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"29⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"31⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"32⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"33⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"35⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"36⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"37⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"39⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"41⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"42⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"43⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"44⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"45⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"46⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"47⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"48⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"49⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"50⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"51⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"51⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"52⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"53⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"54⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"55⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"56⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"56⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"57⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"58⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"59⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"60⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"61⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"62⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"63⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"64⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"64⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"65⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"66⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"67⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"68⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"69⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"70⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"71⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"72⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"73⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"74⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"75⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"76⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"77⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"78⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"79⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"80⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"81⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"82⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"83⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"83⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"84⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"84⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"85⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"86⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"86⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"87⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"87⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"88⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"89⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"90⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"90⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"91⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"92⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"93⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"94⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"95⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"95⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"96⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"97⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"98⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"99⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"99⤵
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"100⤵
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"100⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"101⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"102⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"103⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"104⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"105⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"106⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"107⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"108⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"109⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"110⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"111⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"112⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"113⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"114⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"115⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"116⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"117⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"118⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"119⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"120⤵
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-